EUVD-2026-47867
GHSA-fh8x-qh3j-vhfv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated path traversal yields partial file read only; no integrity or availability impact, no scope change beyond the vulnerable process.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Path traversal in boazsegev facil.io up to version 0.7.58 allows remote unauthenticated attackers to read files outside the configured web root by supplying crafted traversal sequences to the http_sendfile2 function in the Public Folder Handler. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication and no special setup beyond a running facil.io instance with static file serving enabled. A public exploit has been released and the vendor has not responded to the responsible disclosure, leaving all known versions unpatched at time of analysis.
Technical ContextAI
facil.io is a C-language event-driven network and HTTP server framework developed by boazsegev. The vulnerable component is the Public Folder Handler, which uses the http_sendfile2 function in lib/facil/http/http.c to serve static files from a configured web root. CWE-22 (Path Traversal / Improper Limitation of a Pathname to a Restricted Directory) identifies the root cause as insufficient neutralization of path-separator sequences such as ../ or their URL-encoded equivalents before the server resolves and opens the requested file. The result is that a requested path can escape the intended public directory and reference arbitrary files on the host filesystem. CPE cpe:2.3:a:boazsegev:facil.io:*:*:*:*:*:*:*:* covers the entire known version surface through 0.7.58 with no lower-bound exclusion.
RemediationAI
No vendor-released patch has been identified at time of analysis - the project maintainer has not responded to the disclosure at https://github.com/boazsegev/facil.io/issues/170, so no fixed version can be cited. The most effective compensating control is to place a hardening reverse proxy (e.g., nginx or HAProxy) in front of facil.io configured to reject or normalize requests containing ../, .%2e/, %2e./, and other traversal sequences before they reach the application; note this adds operational complexity and must cover all encoding variants. If static file serving is not required, disabling the Public Folder Handler feature entirely eliminates the attack surface with no functional trade-off for API-only deployments. Where static serving is required, ensure the facil.io process runs under a dedicated low-privilege OS user with read access restricted only to the intended web root via filesystem permissions or a chroot/container boundary, which limits the blast radius of traversal even if the filter is bypassed. Monitor the GitHub issue and VulDB entry at https://vuldb.com/cve/CVE-2026-16653 for vendor patch availability.
Denial-of-service in facil.io HTTP/1.1 chunked transfer encoding parser allows remote unauthenticated attackers to crash
Denial-of-service in facil.io 0.6.0 through 0.7.6 permits unauthenticated remote attackers to permanently disable the se
Remote denial-of-service in facil.io through version 0.7.6 allows unauthenticated attackers to crash worker processes by
Remote unauthenticated denial of service affects facil.io (all versions prior to commit 5128747) and iodine (all version
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today